CVE-2024-39683

Katalog CVE

CVSS 6.5 · Medium EPSS 0,61%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada zitadel. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

ZITADEL is an open-source identity infrastructure tool. ZITADEL provides users the ability to list all user sessions of the current user agent (browser). Starting in version 2.53.0 and prior to versions 2.53.8, 2.54.5, and 2.55.1, due to a missing check, user sessions without that information (e.g. when created though the session service) were incorrectly listed exposing potentially other user's sessions. Versions 2.55.1, 2.54.5, and 2.53.8 contain a fix for the issue. There is no workaround since a patch is already available.

Rincian

Terbit di NVD

3 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/zitadel/zitadel/security/advisories/GHSA-cvw9-c57h-3397 advisory vendor
• https://github.com/zitadel/zitadel/commit/4a262e42abac2208b02fefaf68ba1a5121649f04 patch
• https://github.com/zitadel/zitadel/commit/c2093ce01507ca8fc811609ff5d391693360c3da patch
• https://github.com/zitadel/zitadel/commit/d04f208486a418a45b884b9ca8433e5ad9790d73 patch
• https://discord.com/channels/927474939156643850/1254096852937347153 permissions required · url repurposed
• https://github.com/zitadel/zitadel/issues/8213 issue tracking · release notes
• https://github.com/zitadel/zitadel/pull/8231 issue tracking
• https://github.com/zitadel/zitadel/releases/tag/v2.53.8 release notes
• https://github.com/zitadel/zitadel/releases/tag/v2.54.5 release notes
• https://github.com/zitadel/zitadel/releases/tag/v2.55.1 release notes